BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot

From BleepingComputer -

If I read the article correctly, the root security flaw is the same as in Black Lotus ("Baton Drop"). What they're seeing is some users or admins will install the CA 2023 certs, but failed to revoke PCA 2011. Therefore if you haven't revoked PCA 2011, you are still vulnerable to both BlackLotus and its new copycat BlackX.

Key points:
1. Secure Boot mode should be enabled.
2. Installing the new CA 2023 certs only allows you to continue booting new versions of Windows boot manager, past October 2026.
3. But without the separate action of revoking CA 2011, it doesn't close the door on attacks based on security holes from the older boot manager.

Users who don't follow the Secure Boot update process to the letter are still vulnerable as they were before. It's not a new security hole they're exploiting, but the same exploit using a different set of malware from another nation-state actor.

Just a reminder if you have installed the CA 2023 certs, to perform the PCA 2011 revocation ASAP.

Before running these commands, read post #4 just below

To add the “Windows Production PCA 2011” certificate to the Secure Boot UEFI Forbidden List (DBX).
Open a Command Prompt window as an Administrator, type these two commands separately, and then press Enter:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x80 /f

Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

As a pre-requisite for banning PCA 2011, you must have the Windows UEFI CA 2023 cert installed. Which works backwards to already having KEK CA 2023.

If you don't have Windows UEFI CA 2023 (the other CA 2023 certs apply to Linux and option ROM's), then the Secure Boot Task will refuse to ban PCA 2011 (because you don't want to block your UEFI from booting). But that set of commands is correct for revocation.

garlin said:

But that set of commands is correct for revocation.

Click to expand...

Thank you kind sir.

I'd suggest running garlin's Check-UEFI.bat to make sure Windows UEFI CA 2023 is installed, and PCA 2011 has been revoked.

STATUS REPORT
-------------
Scheduled Task: "Secure-Boot-Update" is Ready.

Registry: "UEFICA2023Status" = Updated

SUCCESS: UPDATES ARE FINISHED.
UEFI CA 2023 certs are present, PCA 2011 cert is revoked.

IIRC, if PCA 2011 has not been revoked, instructions on how to do so are also included in the STATUS REPORT.